Data protection in education: what current evidence shows

Data used for the measure in education should be interpreted against stable definitions and an identifiable population. For decisions concerning data protection in education, a revision or break in series should not be reported as a change in performance.

At the publication date, General Data Protection Regulation applicable from May 2018 provides the relevant international context for data protection in education. Any consequential application still requires evidence from the affected jurisdiction or institution. Entry into force or applicability establishes an operative reference point, but the resulting duties must still be traced to the persons, services and jurisdictions covered.

Application to data protection in education

In examining data protection in education: what current evidence shows, for data protection in education, the General Data Protection Regulation applies from 25 May 2018. Education providers processing personal data within its scope must connect each use to an appropriate legal basis and comply with principles governing fairness, transparency, purpose, minimisation, accuracy, retention and security. Rights and accountability are operational matters: notices, access controls, correction, supplier oversight, incident response and records of decision-making should function in practice.

In the context of data protection in education, the relevant outcome should be capable of direct and consistent explanation. Data used for data protection in education should be interpreted against stable definitions and an identifiable population.

Any indicator used in relation to the analysis should distinguish description from causal explanation. For data protection in education, material variation and uncertainty should be reported together with any restriction on wider application. The evidential basis for the available evidence should identify source, period, coverage and material limitations. Corroboration is required where a single record cannot support the decision. Any indicator used in relation to the measure should distinguish description from causal explanation.

Implementation of the issue should be organised around a decision that can be tested. For data protection in education, where an indicator is used as a proxy, the relationship between the proxy and the underlying educational outcome should be stated and tested.

The evidential record for the available evidence should permit a reviewer to trace the matter from decision to outcome. This may require incident response and notification records, retention and secure disposal evidence, data-quality and correction controls, and a register of information assets and purposes, supported by supplier and transfer arrangements and lawful authority and consent records where relevant. Across the defined scope, conflicting records, absent populations and uncertain follow-through require additional testing.

• Minimise collection before it is relied on for a decision with material effect.
• Verify accuracy where information affects learners.
• Provide accessible correction and complaint routes.
• Limit and review access.
• Assign accountable data owners.

Controls for data protection in education

Governance of the issue requires a clear allocation of authority, information and follow-through. Escalation should place material evidence before the authority capable of an effective response.

Data used for the available evidence should be interpreted against stable definitions and an identifiable population. For data protection in education, analysis should state the unit of analysis, reference period, coverage, exclusions and treatment of missing information.

Decision-makers using the available evidence should be told what the data cannot establish as clearly as what it can. When examining data protection in education, the finding should identify its analytical character and the system, institution, programme or learner population to which it applies. The basis for applying the result elsewhere should be established rather than assumed.

For data protection in education, analysis should state the unit of analysis, reference period, coverage, exclusions and treatment of missing information. For comparative analysis, security, privacy and data quality are related but distinct. The evidential basis for the analysis should identify source, period, coverage and material limitations.

For decisions concerning data protection in education, the evidential trail should allow an affected decision to be identified, examined and corrected.

For comparative analysis, governing bodies should receive a concise account of the intended result, affected scope, principal risks, evidence limitations and unresolved exceptions. For data protection in education, an action may be complete while the underlying condition remains, and the two determinations should be recorded separately.